Security Articles from Wikipedia

Public-key cryptography 104
using the correct public keys for different communication segments in all instances to avoid suspicion. This attack
may seem to be difficult to implement in practice, but it's not impossible when using insecure media (e.g., public
networks such as the Internet or wireless communications). A malicious staff member at Alice or Bob's ISP might
find it quite easy to carry out. In the earlier postal analogy, Alice would have to have a way to make sure that the
lock on the returned packet really belongs to Bob before she removes her lock and sends the packet back. Otherwise,
the lock could have been put on the packet by a corrupt postal worker pretending to be Bob to Alice.
One approach to prevent such attacks is the use of a certificate authority, a trusted third party responsible for
verifying the identity of a user of the system and issuing a tamper resistant and non-spoofable digital certificate for
participants. Such certificates are signed data blocks stating that this public key belongs to that person, company, or
other entity. This approach also has weaknesses. For example, the certificate authority issuing the certificate must be
trusted to have properly checked the identity of the key-holder, the correctness of the public key when it issues a
certificate, and has made arrangements with all participants to check all certificates before protected communications
can begin. Web browsers, for instance, are supplied with many self-signed identity certificates from PKI providers;
these are used to check certificate's bonafides (issued properly by the claimed central PKI server?) and then, in a
second step, the certificate of a potential communicant. An attacker who could subvert the certificate authority into
issuing a certificate for a bogus public key could then mount a man-in-the-middle attack as easily as if the certificate
scheme were not used at all. Despite its problems, this approach is widely used; examples include SSL and its
successor, TLS, which are commonly used to provide security in web browsers, for example, to securely send credit
card details to an online store.
Computational cost
Public key algorithms known thus far are relatively computationally costly compared with most symmetric key
algorithms of apparently equivalent security. The difference factor is the use of typically quite large keys. This has
important implications for their practical use. Most are used in hybrid cryptosystems for reasons of efficiency; in
such a cryptosystem, a shared secret key ("session key") is generated by one party and this much briefer session key
is then encrypted by each recipient's public key. Each recipient uses the corresponding private key to decrypt the
session key. Once all parties have obtained the session key they can use a much faster symmetric algorithm to
encrypt and decrypt messages. In many of these schemes, the session key is unique to each message exchange, being
pseudo-randomly chosen for each message.
Associating public keys with identities
The binding between a public key and its 'owner' must be correct, lest the algorithm function perfectly and yet be
entirely insecure in practice. As with most cryptography, the protocols used to establish and verify this binding are
critically important. Associating a public key with its owner is typically done by protocols implementing a public
key infrastructure; these allow the validity of the association to be formally verified by reference to a trusted third
party, in the form of either a hierarchical certificate authority (e.g., X.509), a local trust model (e.g., SPKI), or a web
of trust scheme (e.g., that originally built into PGP and GPG and still to some extent usable with them). Whatever
the cryptographic assurance of the protocols themselves, the association between a public key and its owner is
ultimately a matter of subjective judgment on the part of the trusted third party, since the key is a mathematical entity
while the owner, and the connection between owner and key, are not. For this reason, the formalism of a public key
infrastructure must provide for explicit statements of the policy followed when making this judgment. For example,
the complex and never fully implemented X.509 standard allows a certificate authority to identify its policy by
means of an object identifier, which functions as an index into a catalog of registered policies. Policies may exist for
many different purposes, ranging from anonymity to military classification.